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REMARKS/ARGUMENTS 



Claims 1 - 30 are pending. Claim 6 has been amended. 

Objections to the specification were raised in connection with references to a 



related application made in the specification. The specification has been amended accordingly as 
shown above. 

Claim 1 was rejected under 35 U.S.C. § 102(e) for allegedly being anticipated by 
Riddle et al., U.S. Patent No. 6,457,051. 

Claims 2 - 30 were rejected under 35 U.S.C. § 103(a) for allegedly being 
unpatentable in view of the following combination of references: 



• claim 2: Riddle et al. and Del Monte, U.S. Patent No. 5,704,060; 

• claims 3, 4, 6 - 8, and 27: Riddle et al. and Tang, U.S. Patent 
No. 5,378,126; 

• claims 5, 9, 10, 18, 22, 23, 28, and 29: Riddle et al, Tang, and Del Monte; 

• claims 15 and 30: Riddle et al., Tang, and Boucher et al., U.S. Patent 
No. 6,226,680; 

• claims 16 and 17: Riddle et al., Tang, Del Monte, and Moreno, U.S. Patent 
No. 5,951,674; 

• claims 19, 20, 24 - 26: Riddle et al., Tang, Del Monte, and Boucher; and 

• claim 21 : Riddle et al., Tang, Del Monte, Boucher, and Moreno. 

Claims 11-14 were deemed to "not add any new limitations above claims 1-11 



The present invention recited in claim 1 is directed to the identification of 



protocol encapsulation in network data. Claim 1 includes "providing a grammar" and "parsing 
incoming network data using said grammar." Riddle et al. was cited for allegedly showing the 
use of a grammar. Column 13, lines 57 - 67 were cited in support of this assertion, shown below: 



"FIG. 4A depicts a flowchart 401 of processing steps for automatically 
classifying traffic. In a step 402, a flow specification is parsed from the 
flow being classified. Then in a step 404, the flow specification parsed 
from the flow in step 402 is compared with the traffic specifications in 
each node of the classification tree. Rules are checked starting from 
most specific to least specific . In a decisional step 406, a determination 



and therefore are rejected for similar reasons. 



Section 102 Rejection of Claim 1 
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is made if traffic matches one of the classes being classified. If this is 
so, then in a step 408, an entry is made in a list of identifying 
characteristics, such as protocol type (SAP), IP protocol number, 
server port, traffic type if known, MIME type, a time of occurrence of 
the traffic." Col 13, lines 57- 67 (underlining added). 

The grammar recited in claim 1 was asserted to be "the rules of matching the data packets to a 
traffic specification." OA., page 3, lines 1-2, 

A particularly relevant aspect of the present invention is the idea of treating 
network data as a language. With this view of network data, claim 1 recites an important aspect 
of the invention, namely, providing a grammar and using that grammar to parse incoming 
network data. Each of the remaining independent claims 6, 11, 18, and 27 also recite this aspect 
of the invention. 

Riddle et al. do not define a grammar. Riddle et al. do not describe or suggest that 
the traffic flow can be viewed as a language that can be subject to grammatical (and as recited in 
other claims, lexical) analysis. Riddle et al. describe the use of a traffic class tree to classify a 
flow; a data structure which, as explained below, would not be understood by one of ordinary 
skill to be a grammar. 

Riddle et al. observe that traffic class membership may be hierarchical and teach 
that traffic flow may be classified by a series of steps through a traffic class tree. Col 10, lines 
19 - 20. As Riddle et al. explain, "[e]ach node of the classification tree represents a class, and 
has a traffic specification, i.e., a set of attributes or characteristics describing the traffic 
associated with it. Leaf nodes of the classification tree may contain policies." Id, lines 28 - 41. It 
is earnestly submitted that one of ordinary skill in the art would not interpret "traffic 
specification" and "attributes or characteristics describing the traffic" to be components of a 
grammar. 

Riddle et al. further teach that their traffic class tree "is an N-ary tree with its 
nodes ordered by specificity. . . . Key to implementing this hierarchy is that the nodes are 
arranged in decreasing order of specificity." Id, lines 42 - 43 and 59 - 61. Again, it is earnestly 
submitted that one of ordinary skill would not recognize "nodes ordered by specificity" or 
"nodes arranged in decreasing order of specificity" as elements of a grammar. 
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Riddle et al. show an example in Fig. 2 A of a classification tree that is ordered 
first by organizational departments. In classifying a particular flow in this tree, the attributes of 
the flow are compared with the traffic specification in each successive department node. If a 
match is found, then classification moves to the children of this department node. The child 
nodes may be ordered by an orthogonal paradigm such as, for example, a service type. Id, lines 
44 - 54. It is respectfully submitted that one of ordinary skill in the art would not interpret this 
example as representative of a grammar; 

For at least the foregoing reasons, the Section 102 rejection of claim 1 is believed 
to be overcome. 

Section 103 Rejection of Claim 2 

A further aspect of the invention recited in claim 2 is "said grammar is a grammar 
graph" and "providing a deterministic finite automaton (DFA) representing said grammar 
graph." Del Monte was cited for showing a DFA. 

As discussed above, an important aspect of the present invention is the view that 
network data can be processed as a language. Also, as discussed above, Riddle et al. do not 
show the use of a grammar. Riddle et al. do not describe the traffic flow as a language that can 
be processed by the use of a grammar. The traffic tree examples shown in Figs. 2A and 2B 
would not be understood by one of ordinary skill as being a grammar graph. It is therefore 
respectfully submitted that the Examiner improperly relied on the teachings of the present 
invention as the basis for looking to the DFA of Del Monte. 

Del Monte teaches lexical scanning of text in a document. "The system and 
method of this invention comprise a lexical parser which divides the text of a document into 
search terms." Col 2, lines 57 - 59. "[T]he scanner 1 10 is reset to the beginning of the document 
10, so that the lexical parser 120 may use it to scan the document 10." Col 13, lines 53 - 55. Del 
Monte does not show or suggest that network data can be viewed as a language and thus be 
subjected to analysis under a grammar. 
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Absent, the teachings of the present invention, there is no suggestion to 



incorporate Del Monte's DFA into the Riddle et al. to obtain the present invention. The Section 
103 rejection of claim 2 is believed to be overcome. 

Section 103 Rejection of Claims 3, 4, 6 - 8, and 27 



A further aspect of the present invention is recited in independent claim 6, for 



example, "lexically scanning said data packet to produce plural lexical tokens, parsing said, 
lexical tokens using said grammar ." Though it is understood that parsing is performed using said 
grammar, claim 6 nonetheless was amended to explicitly recite this. For example, independent 
claim 27 as originally filed recites "parsing through said lexical tokens using a grammar." 



Tang was cited for teaching a lexical scanning technique. The Examiner asserted 



"include lexical scanning of packets and parsing lexical tokens in 
Riddle because doing so would allow the processor to read the 
specific lexical token relating to the control protocol layer that the 
instruction belongs to rather than reading the whole instruction or 
packet and thus create faster communications medium and faster 
data routing ." OA. page 4, last five lines (underlining added). 

Another particularly relevant aspect of the present invention is the treatment of 



network data as lexical tokens for the purpose of packet classification. It is respectfully and 
earnestly submitted that the Examiner improperly applied hindsight knowledge gleaned from the 
present invention when he characterized the data in Riddle et al. as "specific lexical token" to 
justify inclusion of the lexical scanning technique shown by Tang. 



Neither Riddle et al. nor Tang provide any suggestion, express or otherwise, to 



subject network data to lexical analysis. Riddle et al. performs classification using a 
classification tree. One of ordinary skill in the relevant art will understand that classification 
trees do not represent or suggest the idea of lexical scanning. 



Tang is directed to a method for compiling programs. Lexical scanning is a 



common technique used in compilers for computer programs. Tang describes conventional 
program compiler techniques for compiling computer program languages. There is no 
suggestion by Tang to apply the technique of lexical scanning to network data. 



it would be obvious to: 
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Absent teachings from the present invention, there is no suggestion to view 
network data as lexical tokens, or that network data can be subjected to lexical scanning 
techniques to perform network data packet classification. 

In addition, while the notion to "create faster communications medium and faster 
data routing" is desirable, it does not suggest how that might be achieved, only that it might be a 
desirable goal. Thus, creating faster communications and faster data routing does not suggest the 
specific scanning technique of lexical scanning. 

The Section 103 rejection of claims 3 , 4, 6 - 8, and 27 is believed to be overcome. 

Section 103 Rejection of Claims 5, 9, 10, 18, 22, 23, 28, and 29 

Claims 5, 9, 10, 18, 22, 23, 28, and 29 were rejected based on Riddle et al. for 
allegedly showing a grammar, and further in view of Del Monte for showing DFA's, and in view 
of Tang for showing lexical scanning. However, for the reasons stated above, Riddle et al. do 
not show a grammar. More specifically, Riddle et al. do not show a grammar in their traffic 
classification tree. Absent the impermissible hindsight teachings of the present invention, one of 
ordinary skill would not be motivated to incorporate either the DFA of Del Monte or the lexical 
scanning of Tang to obtain the present invention as recited in any of claims 5, 9, 10, 18, 22, 23, 
28, and 29. Neither Del Monte nor Tang suggest the use of DFA's or lexical scanning, 
respectively, to process network data. Since Riddle et al. do not suggest that traffic flow can be 
subjected to processing under a grammar, the cited references considered individually or in 
combination do not render obvious claims 5, 9, 10, 18, 22, 23, 28, and 29. The Section 103 
rejection of these claims is believed to be overcome. 

Section 103 Rejection of Claims 16 and 17 

An aspect of the invention recited in claims 16 and 17 is "said regular expressions 
further include skip operations." The Examiner cited Moreno's claims 7 and 8 for allegedly 
showing this aspect of the invention. The Examiner asserts that the proposed combination of 
Riddle et al. and Moreno "would allow the processor to detect an error in the stream of incoming 
data and skip to the next data stream by detecting an address of the beginning of the next 
incoming data packet." O.A., page 10, 4 th full paragraph (underlining added). While the branch 
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address in a program instruction sequence is known a priori by virtue of compiling source code, 
such addressing information does not exist in network data packets such as those processed by 
Riddle et al. as to allow for detecting "the beginning of the next incoming data packet." A 
person of ordinary skill will understand that network data packets do not operate in this manner. 
There is no relation between one packet and another packet such that the beginning of the packet 
can be determined by performing a skip operation using predetermined branch addresses as 
taught by Moreno. 

The Section 103 rejection of claims 16 and 17 is believed to be overcome. 

Section 103 Rejection of Claims 19, 20, 24 - 26 

An aspect of the invention recited in dependent claim 19, for example, is "said 
regular expressions include arithmetic instructions and logic instructions." Boucher et al. 
describe an intelligent network interface card (INIC). Boucher et al. show in Fig. 14 a pipelined 
microprocessor 470, which naturally includes an arithmetic and logic unit (ALU 602). However, 
the ALU of Boucher et al. does not teach or suggest "regular expressions" that "include 
arithmetic instructions and logic instructions." As recited in base claim 18, "network data 
packets comprising a stream of data . . . [are scanned] with said DFA to find a matching one of 
said regular expressions thereby producing plural lexical tokens." With respect, it is not at all 
clear how processing data packets with the ALU of Boucher et al. would suggest the inclusion of 
"arithmetic instructions and logic instructions" to regular expressions as recited in claim 19. 

As to claims 24 - 26, the recited memories are configured with information about 
the DFA recited in base claim 18. Boucher et al. show memory components. However, Boucher 
et al. do not show memory components configured for a DFA or that the DFA represents "a 
grammar graph and plural regular expressions" in a network data packet classifier, recited in 
base claim 18 

The Section 103 rejection of claims 19, 20, 24 - 26 is believed to be overcome. 
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Rejection of Claims 11 - 14 

A further aspect of the present invention is recited in claim 1 1, for example, of 
"compiling said grammar packet classification language to produce a grammar graph." Riddle et 
al. show the use of a traffic classification tree. They do not describe a step of performing a 
compile operation to produce the traffic classification tree. In fact, Riddle et al. teach that "[t]he 
present invention provides a method for classifying traffic according to a definable set of 
classification attributes selectable by the manager, including selecting a subset of traffic of 
interest to be classified." Col 10, lines 12-16. One of ordinary skill would not interpret such 
classification attributes as being the result of "compiling said grammar packet classification 
language to produce a grammar graph." Riddle et al. do not show a grammar. Riddle et al. do 
not show performing a compile operation to produce a grammar tree. The rejection of claims 1 1 
- 14 is believed to be overcome. 

CONCLUSION 

All claims now pending in this Application are believed to be in condition for 
allowance. The issuance of a formal Notice of Allowance at an early date is respectfully 
requested. 

If the Examiner believes a telephone conference would expedite prosecution of 
this application, please telephone the undersigned at 650-326-2400. 



Respectfully submitted. 




Gedfge B. F. Yee 
Reg. No. 37,478 
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